Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2024 12:25

General

  • Target

    10835bbaba51e62af438366f2128e5f5_JaffaCakes118.rtf

  • Size

    1.3MB

  • MD5

    10835bbaba51e62af438366f2128e5f5

  • SHA1

    0763eb8bfb1439878c4c02ce4e950c07275ebf02

  • SHA256

    4195ef696648e960bcd28f15347ed3c6454b8dec1bbe5adc54c9a341c1070e89

  • SHA512

    d37cd3e3f80ca2525aadf73b964331109ae7b9aca4997b946fa83aaff8a1a9622ea8d59644f81ef36ae59ef848d9dfc327ffcfea15c3d97edfa3985d34487aa3

  • SSDEEP

    24576:ndHDcq47d/mF6dxhXwsnfPf+5+XP0WF0ncXr4r/UjZLjkr12JzQf/jpYzQcwwKs4:9

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Kills process with taskkill 1 IoCs
  • Launches Equation Editor 1 TTPs 2 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10835bbaba51e62af438366f2128e5f5_JaffaCakes118.rtf"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\intel.scr
      "C:\Users\Admin\AppData\Local\Temp\intel.scr" /S
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\task.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\task.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\exe.exe
            exe.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            PID:856
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\exe.exe
              exe.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2368
              • C:\Users\Admin\AppData\Local\Temp\exe\exe.exe
                "C:\Users\Admin\AppData\Local\Temp\exe\exe.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:3056
                • C:\Users\Admin\AppData\Local\Temp\exe\exe.exe
                  "C:\Users\Admin\AppData\Local\Temp\exe\exe.exe"
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:2956
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\exe.exe"
                7⤵
                  PID:2800
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 1.1.1.1 -n 1 -w 1000
                    8⤵
                    • Runs ping.exe
                    PID:2660
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im winword.exe
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2184
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
              5⤵
                PID:1880
              • C:\Windows\SysWOW64\reg.exe
                reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
                5⤵
                  PID:1352
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
                  5⤵
                    PID:1616
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
                    5⤵
                      PID:616
                    • C:\Windows\SysWOW64\reg.exe
                      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
                      5⤵
                        PID:1912
                      • C:\Windows\SysWOW64\reg.exe
                        reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
                        5⤵
                          PID:2212
                        • C:\Windows\SysWOW64\reg.exe
                          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
                          5⤵
                            PID:1856
                          • C:\Windows\SysWOW64\reg.exe
                            reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
                            5⤵
                              PID:2384
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
                              5⤵
                                PID:1864
                                • C:\Windows\SysWOW64\reg.exe
                                  REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
                                  6⤵
                                    PID:2216
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
                                  5⤵
                                    PID:1064
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
                                      6⤵
                                        PID:908
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
                                      5⤵
                                        PID:276
                                        • C:\Windows\SysWOW64\reg.exe
                                          REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
                                          6⤵
                                            PID:2312
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                                          5⤵
                                            PID:2332
                                            • C:\Windows\SysWOW64\reg.exe
                                              REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                                              6⤵
                                                PID:2976
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                                              5⤵
                                                PID:1232
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                                                  6⤵
                                                    PID:2044
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                                                  5⤵
                                                    PID:2380
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                                                      6⤵
                                                        PID:768
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                                      5⤵
                                                        PID:1088
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                                          6⤵
                                                            PID:1604
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                                          5⤵
                                                            PID:1720
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                                              6⤵
                                                                PID:1916
                                                      • C:\Users\Admin\AppData\Local\Temp\intel.scr
                                                        "C:\Users\Admin\AppData\Local\Temp\intel.scr" /S
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1132
                                                        • C:\Windows\SysWOW64\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\task.vbs"
                                                          3⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2788
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\task.bat" "
                                                            4⤵
                                                              PID:1636
                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                                        1⤵
                                                        • Launches Equation Editor
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2852
                                                        • C:\Windows\SysWOW64\CmD.exe
                                                          CmD /C %tmp%\intel.scr & UUUUUUUU c
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2120
                                                          • C:\Users\Admin\AppData\Local\Temp\intel.scr
                                                            C:\Users\Admin\AppData\Local\Temp\intel.scr
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2328
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\task.vbs"
                                                              4⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:668
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\task.bat" "
                                                                5⤵
                                                                  PID:1812
                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                                          1⤵
                                                          • Launches Equation Editor
                                                          PID:2288

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\task.vbs

                                                          Filesize

                                                          108B

                                                          MD5

                                                          00f4d3f775c6ac6f1746153371614806

                                                          SHA1

                                                          adb7b3a57c38e27dce59dd700373798eca0cfb6b

                                                          SHA256

                                                          72175df25e14f2daa73d33844d211ef3d6ee253c5475de893bdc16d7210a6865

                                                          SHA512

                                                          0f5752953faaa833bce11215112880d59c48f8ab3c7de2c9e7c46b4975f74b5f29ed8c63e6c5d94807d6cc8dbfa11b5038b166e577874af84497243e762e3f51

                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\task.bat

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          9349b55fa165d64cbb4913fe3d2e86bd

                                                          SHA1

                                                          0a4f64064e19c46b18261fbec5879548bda10977

                                                          SHA256

                                                          c821c21c4b495d1017bcddee20bf6b0b9ad9b5b1d0068b1c1e888a4d0f1ad2bd

                                                          SHA512

                                                          4dc25ee0f6158e0e2340c2eb85330ae2bb4bea95c0f45a49a00ef7ee69a01fa1d9c10de999d5740e03f394db02dd00670e946d63e34977e6bef531f51d9809d5

                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\decoy.doc

                                                          Filesize

                                                          32KB

                                                          MD5

                                                          98c7b258be8ff2d03181f28b32de76d1

                                                          SHA1

                                                          6e3e523e4600c572983b164fa9d539ca0dff2f93

                                                          SHA256

                                                          e4f7827d6b6e271d0f876ee69833e4cdb26ce87f11238225d6a5740f140961fa

                                                          SHA512

                                                          a4e6393d795d1da56276251f25cb49b68cee5651d486e9b536f8843af3952fa34445277c5648ac9f180caf5c7052fc03b371a304d9b79317bc060b565dc480e9

                                                        • C:\Users\Admin\AppData\Local\Temp\inteldriverupd1.sct

                                                          Filesize

                                                          567B

                                                          MD5

                                                          3e080b9dc1195efed3b2a5d8bd27adf1

                                                          SHA1

                                                          17b7ddaf62d0d149a158c58274fe155559e0bd2a

                                                          SHA256

                                                          0ffa8cb2784d7ce3342c94f102d746740f4059a931d8c0ba2c35724aa3c2ebdc

                                                          SHA512

                                                          816937931b2ff006103cb5059bb000870421145dfa94b09885b93857f62edd62db4babb1ef4b3ce42992c45771eb97de31ec2d040e66ce9ebf78a027be586e2c

                                                        • C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

                                                          Filesize

                                                          51B

                                                          MD5

                                                          cda75ec241c0c317b0019512d109af2d

                                                          SHA1

                                                          0907aab88e05807c1eff7d477ce17fcd4176dd3b

                                                          SHA256

                                                          a26850091b69aed12f3889f907e1ae262816b58cf90b6c81f101f2a57a4df5f7

                                                          SHA512

                                                          4a2694bd6bff671b5e2b131f60b752c95e1c578ec4c22ace6ef8dbc5543851fcf7cccd683a02912d6bc0c0cca09659d26983def4df168e1ba0a0871c3a624841

                                                        • \Users\Admin\AppData\Local\Temp\RarSFX0\exe.exe

                                                          Filesize

                                                          438KB

                                                          MD5

                                                          c3873540a8a330e894523f1f99e9ab83

                                                          SHA1

                                                          e62576ce0a83fa0d55352769b45ac7c24d6b05c0

                                                          SHA256

                                                          0eaa4cbaeccf82a448964d79b9934773896c4c824b4f6fbf127f07c3adc67e54

                                                          SHA512

                                                          2dc32fd0ce39f98722532dc509b13070325d831f3e63e605dc41ac8fa9e50c483a33b0599b15116097ab8be70b2656a9ebadcfec5ea39c98ca2654c70fc402f7

                                                        • \Users\Admin\AppData\Local\Temp\intel.scr

                                                          Filesize

                                                          622KB

                                                          MD5

                                                          a054fa130c7f61330bc433aec47cd74d

                                                          SHA1

                                                          47e2a6fd78f9ba64c961833ef69494dd6f5aa127

                                                          SHA256

                                                          cfa35d9d629183aa990bde0d911c0d1abecad540d25e35a7e0e0d8ec9ef14ecd

                                                          SHA512

                                                          b2ec89b7dde509d2e52e9ef38708948178c40801965c63ae3849bb27a122617faa6766dfe0babf0d1aab66b0c5654a3f5f9e67bc202573c116bfbea12371ce1c

                                                        • memory/1088-117-0x00000000773F0000-0x00000000774EA000-memory.dmp

                                                          Filesize

                                                          1000KB

                                                        • memory/1088-116-0x00000000774F0000-0x000000007760F000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2368-100-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-96-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-94-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-93-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2368-101-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-113-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-112-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-110-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-107-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-106-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-104-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-102-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-115-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-99-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-98-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-97-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2368-91-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2392-2-0x00000000713ED000-0x00000000713F8000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2392-88-0x00000000713ED000-0x00000000713F8000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2392-0-0x000000002F571000-0x000000002F572000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2392-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2956-142-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-140-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-149-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-148-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-146-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-143-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-129-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-151-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-138-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-137-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-136-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-135-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-134-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-133-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-132-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/2956-130-0x0000000000400000-0x0000000000460000-memory.dmp

                                                          Filesize

                                                          384KB